Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt Electricity

Rowan Ashford

Published: January 24, 2026 4:21 PM ET

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt Electricity

Poland’s energy infrastructure faced a cyber threat recently when wiper malware attempted to disrupt electricity delivery. This incident reportedly occurred during the last week of December and is believed to be linked to Russian state-sponsored hackers.

Details of the Cyberattack

According to reports from Reuters, the cyberattack aimed to interfere with communication between renewable energy installations and power distribution operators. However, the attack failed to achieve its intended goal, although specific reasons for this failure have not been disclosed.

What is Wiper Malware?

The security firm ESET revealed that the malware involved is identified as a wiper. This type of malware is designed to permanently erase data and code from servers, ultimately aiming to disrupt operations completely.

Attack Attribution

Researchers linked the malware to the Russian hacker group known as Sandworm.
ESET assessed the attack with medium confidence based on the malware’s tactics and previous activities linked to Sandworm.
ESET’s analysis indicated a strong overlap with prior wiper attacks associated with this group.

Background on Sandworm

Sandworm has a notorious history of executing destructive cyberattacks for the Kremlin, often targeting perceived adversaries. One major incident occurred in December 2015 when a similar attack on Ukraine’s power grid left approximately 230,000 people without electricity for nearly six hours during a particularly cold winter period.

Previous Attacks and Techniques

In that incident, hackers utilized malware named BlackEnergy to infiltrate power companies’ supervisory control and data acquisition systems. This allowed them to halt electricity distribution by exploiting legitimate system functionalities.

Conclusion

Despite the recent attack on Poland’s energy grid, ESET confirmed that there was no successful disruption of services. This incident highlights ongoing cybersecurity threats against critical infrastructures worldwide.